Mozilla Foundation Security Advisory 2011-39
Defense against multiple Location headers due to CRLF Injection
- Announced
- September 27, 2011
- Reporter
- Ian Graham
- Impact
- Moderate
- Products
- Firefox, SeaMonkey, Thunderbird
- Fixed in
-
- Firefox 3.6.23
- Firefox 7
- SeaMonkey 2.4
- Thunderbird 3.1.15
- Thunderbird 7
Description
Ian Graham of Citrix Online reported that when multiple
Location headers were present in a redirect response
Mozilla behavior differed from other browsers: Mozilla would use the second
Location header while Chrome and Internet Explorer would use
the first. Two copies of this header with different values could be a symptom
of a CRLF injection attack against a vulnerable server. Most commonly it is
the Location header itself that is vulnerable to the response
splitting and therefore the copy preferred by Mozilla is more likely to be
the malicious one. It is possible, however, that the first copy was the
injected one depending on the nature of the server vulnerability.
The Mozilla browser engine has been changed to treat two copies of this
header with different values as an error condition. The same has been done
with the headers Content-Length and Content-Disposition